CVE-2026-80747

The Linux kernel's drm/amdkfd driver (AMD Kernel Fusion Driver) fails to fully validate CRAT (Component Resource Attribute Table) tables: it checks that each subtype header fits within the table image but not that the advertised subtype length fits, so a malformed CRAT table with an oversized length field causes out-of-bounds reads when kfd_parse_subtype() casts the header to specific subtype structures. Triggering the flaw requires the kernel to parse a malformed or crafted CRAT table, which can come from platform firmware or other sources supplying the table. Per the CVSS vector (AV:L/AC:L/PR:N/UI:N, C:H/I:L/A:H), an attacker with local access gains kernel information disclosure and can crash the system, with limited integrity impact. Only Linux systems running kernels that include and use the amdkfd driver — i.e., AMD APU/GPU platforms — are affected, and the disclosure does not enumerate specific affected version ranges. There is no public proof-of-concept, no CISA KEV listing, and EPSS is 0.2%, indicating no known exploitation at this time.

What to do: Update to a kernel build from your distribution that includes the backported fix (upstream commit 48e1d1e6e8798aef0312e68d8e586021b5b3cf4d); check your kernel package changelog for this commit. Systems not running AMD APUs/GPUs or not loading amdkfd are not exposed; since there is no public PoC or in-the-wild exploitation, patch on the normal maintenance cycle, prioritizing devices with unusual firmware or virtualized/hypervisor-supplied CRAT data.